From 2d6a57bcc24a792675c736cfdf50b4f91cea49ee Mon Sep 17 00:00:00 2001 From: vahidmalekk <46035912+vahidmalekk@users.noreply.github.com> Date: Mon, 26 Oct 2026 21:55:04 +0330 Subject: [PATCH 1/2] Add linux auditd cross-process ptrace (PTRACE_SEIZE) dataset (T1055.008) Real auditd SYSCALL/OBJ_PID/PROCTITLE records captured from a host where a tracer (strace) attaches to a running process via ptrace. Keyed as tracing. Supports the Linux Auditd Cross-Process Ptrace Activity detection. --- .../linux_auditd_ptrace/linux_auditd_ptrace.log | 12 ++++++++++++ .../linux_auditd_ptrace/linux_auditd_ptrace.yml | 13 +++++++++++++ 2 files changed, 25 insertions(+) create mode 100644 datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log create mode 100644 datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.yml diff --git a/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log b/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log new file mode 100644 index 00000000..4019993c --- /dev/null +++ b/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log @@ -0,0 +1,12 @@ +type=SYSCALL msg=audit(1793036923.965:1122): arch=c000003e syscall=101 success=yes exit=0 a0=4206 a1=ad6 a2=0 a3=0 items=0 ppid=2772 pid=2773 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="strace" exe="/usr/bin/strace" subj=unconfined key="tracing" ARCH=x86_64 SYSCALL=ptrace AUID="root" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" +type=OBJ_PID msg=audit(1793036923.965:1122): opid=2774 oauid=0 ouid=0 oses=3 obj=unconfined ocomm="strace" OAUID="root" OUID="root" +type=PROCTITLE msg=audit(1793036923.965:1122): proctitle=737472616365002D700032373638 +type=SYSCALL msg=audit(1793036923.967:1137): arch=c000003e syscall=101 success=yes exit=0 a0=4206 a1=ad0 a2=0 a3=51 items=0 ppid=2772 pid=2773 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="strace" exe="/usr/bin/strace" subj=unconfined key="tracing" ARCH=x86_64 SYSCALL=ptrace AUID="root" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" +type=OBJ_PID msg=audit(1793036923.967:1137): opid=2768 oauid=0 ouid=0 oses=3 obj=unconfined ocomm="sleep" OAUID="root" OUID="root" +type=PROCTITLE msg=audit(1793036923.967:1137): proctitle=737472616365002D700032373638 +type=SYSCALL msg=audit(1793037457.572:1202): arch=c000003e syscall=101 success=yes exit=0 a0=4206 a1=e8d a2=0 a3=0 items=0 ppid=3723 pid=3724 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="strace" exe="/usr/bin/strace" subj=unconfined key="tracing" ARCH=x86_64 SYSCALL=ptrace AUID="root" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" +type=OBJ_PID msg=audit(1793037457.572:1202): opid=3725 oauid=0 ouid=0 oses=3 obj=unconfined ocomm="strace" OAUID="root" OUID="root" +type=PROCTITLE msg=audit(1793037457.572:1202): proctitle=737472616365002D700033373231002D6F002F6465762F6E756C6C +type=SYSCALL msg=audit(1793037457.574:1217): arch=c000003e syscall=101 success=yes exit=0 a0=4206 a1=e89 a2=0 a3=51 items=0 ppid=3723 pid=3724 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="strace" exe="/usr/bin/strace" subj=unconfined key="tracing" ARCH=x86_64 SYSCALL=ptrace AUID="root" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" +type=OBJ_PID msg=audit(1793037457.574:1217): opid=3721 oauid=0 ouid=0 oses=3 obj=unconfined ocomm="sleep" OAUID="root" OUID="root" +type=PROCTITLE msg=audit(1793037457.574:1217): proctitle=737472616365002D700033373231002D6F002F6465762F6E756C6C diff --git a/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.yml b/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.yml new file mode 100644 index 00000000..cc301428 --- /dev/null +++ b/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.yml @@ -0,0 +1,13 @@ +author: vahid malekmohammadi +id: 7d709b3d-ed24-4b8d-ac67-6233b2c3adfa +date: '2026-10-26' +description: Generated dataset for linux auditd cross-process ptrace (PTRACE_SEIZE) in attack range. A tracer (strace) attaches to a running process via ptrace, producing SYSCALL (syscall=ptrace), OBJ_PID and PROCTITLE records keyed as tracing. +environment: attack_range +directory: linux_auditd_ptrace +mitre_technique: +- T1055.008 +datasets: +- name: linux_auditd_ptrace + path: /datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log + sourcetype: auditd + source: auditd From f2b49b9265a3c2bd8a6eaa51dfd573d440afaf9e Mon Sep 17 00:00:00 2001 From: vahidmalekk <46035912+vahidmalekk@users.noreply.github.com> Date: Thu, 29 Oct 2026 15:51:43 +0330 Subject: [PATCH 2/2] Update linux_auditd_ptrace.log wConvert ptrace dataset log to Git LFS (1/2)ith new audit entries --- .../T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log | 1 + 1 file changed, 1 insertion(+) diff --git a/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log b/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log index 4019993c..0a9f7709 100644 --- a/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log +++ b/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log @@ -10,3 +10,4 @@ type=PROCTITLE msg=audit(1793037457.572:1202): proctitle=737472616365002D7000333 type=SYSCALL msg=audit(1793037457.574:1217): arch=c000003e syscall=101 success=yes exit=0 a0=4206 a1=e89 a2=0 a3=51 items=0 ppid=3723 pid=3724 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="strace" exe="/usr/bin/strace" subj=unconfined key="tracing" ARCH=x86_64 SYSCALL=ptrace AUID="root" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" type=OBJ_PID msg=audit(1793037457.574:1217): opid=3721 oauid=0 ouid=0 oses=3 obj=unconfined ocomm="sleep" OAUID="root" OUID="root" type=PROCTITLE msg=audit(1793037457.574:1217): proctitle=737472616365002D700033373231002D6F002F6465762F6E756C6C +